0

I'm in the process of implementing wired 802.1x. I've been testing with HP 2530 switches and everything seems to work okay enough. On a different site I use Brocade (now Ruckus) 6450 switches. I can enable 802.1x and devices can authenticate.

The HP switches appeared to authenticate for the port on the switch, but the brocade switches seem to authenticate the mac address. The difference being that if I attach another switch to the HP switch then multiple devices or mac addresses can have their traffic pass on the single port. On the brocade device any new mac addresses are expected to authenticate. But because the second switch I have added is doing the authentication the clients connected to this switch end up being blocked.

I can't test it right at this minute with a wireless access point but my testing suggests that whilst my access point can authenticate, the clients connected to the access point cannot. I also have a number of Axis network video encoders (P7216 https://www.axis.com/en-gb/products/axis-p7216) which while only having a single network port utilise four MAC and IP Addresses. Again I imagine only one of the MAC addresses would authenticate.

Does anyone have any experience of this? I think it should be a feature I can disable (or have only enabled inadvertently.) But I'm not sure what it might be called. I can see how authenticating multiple devices on a single port could be useful but in the cases I have given this isn't so.

Thanks

EDIT:
Currently for testing purposes I am using a HP/Aruba 2530-8 switch as my supplicant. I will actually be using Arbuba AP-315 wireless access points and the axis device I mentioned. This is because the Authenticator switch I have on site doesn't support POE and the Axis encoders are in production.

On the site that I work we use HP/Aruba 2530-48g-poe+ switchs as access switches. When I connect the 2530-8 to the 2530-48-poe+ switch the radius server returns the vlan configuration in the usual manner and the port on the authenticator is configured as specified. Clients that plug into the 2530-8 switch don't need to authenticate against the 2530-8 switch and they can access the network through the port that has been enabled on the 2530-48-poe+ switch. This is what I want to happen.

On another site we use Brocade 6450 switches. When the same 2530-8 switch plugs in to the brocade switch the 2530-8 switch is enable and I can ping the management interface of the supplicant switch. However clients that are connected to the 2530-8 are blocked by the brocade switch that acts as the authenticator because it sees the mac addresses of the clients and deems them to not have authenticated. I do not want this.

I believe in Aruba/HP these two scenarios are port mode 802.1x and user mode 802.1x. But I'm not sure this translates to other manufacturers. Brocade has documentation on using multiple users that are authenticated on a single port but the implementation doesn't work how I want. Effectively the client is still required to authenticate against the brocade switch but this is in turn blocked by the 2530-8 switch as it is handling the authentication.

Improve this question
3
  • 1
    Simply put, you don't authenticate interconnect ports. You only ever authenticate edge ports.
    – Zac67 ♦
    Commented Aug 9, 2019 at 13:44
  • 802.1X is designed for the access interfaces. You description means that would be on the HP, not the Brocade to which the HP is connected. You are trying to use it incorrectly.
    – Ron Maupin ♦
    Commented Aug 15, 2019 at 13:19
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 15, 2019 at 7:52

1 Answer 1

Reset to default
2

802.1X is a port authentication protocol that is designed for edge ports - single link, single client, single MAC address.

You use 802.1X when there's no better way to secure port access. Better and possibly more secure methods include securing physical access - keeping the cabinet or closet locked at all times.

As a side note, 802.1X is not fool-proof by design (at all...). Only few implementations are really hard to fool - often a simple repeater hub with an authenticating client does the trick. If you need "perfect" security you'll require MACsec.

802.1X doesn't make sense when there are multiple MAC addresses one a port. While multiple MACs do work with several implementations, they don't with others (which is actually slightly better than plain 802.1X).

Generally, you don't use 802.1X between switches, other bridging devices, or towards routers or hosts - there are better options, see above.

Summing up, you'd use 802.1X only on your edge switches and there only on the edge ports, not on the uplinks.

Improve this answer
10
  • I appreciate the limitations of 802.1x but that doesn't answer my question. I'm implementing 802.1x on the edge and the Axis P7216 is a single device. However as I have stated it uses four hardware addresses. It doesn't support 802.1AE and neither do my switches. I can (barely) secure my cabinets but that doesn't secure the other end of the cable that's plugged in to my switch.
    – John Sayce
    Commented Aug 9, 2019 at 14:45
  • I'm afraid there's no other answer than "it won't work that way"...
    – Zac67 ♦
    Commented Aug 9, 2019 at 15:32
  • When you say "it won't work that way," do you mean for these switches or all switches?
    – John Sayce
    Commented Aug 13, 2019 at 8:06
  • @JohnSayce I haven't seen any switches yet that can authenticate themselves using 802.1X (doesn't make sense either as per IEEE), so that's "for all switches".
    – Zac67 ♦
    Commented Aug 13, 2019 at 11:54
  • 1
    That is your problem: When you plug clients into the 2530-8 and that into the Brocade, you don't authenticate the clients on the Brocade but on the 2530-8.
    – Zac67 ♦
    Commented Aug 15, 2019 at 11:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.